On both servers I have exactly the same custom mod security rules as follows (the paths are slightly different on Server1 because the directory in use is still usr/local/apache/conf - whereas server 2 EasyApache4 has changed the file paths to /etc/apache2/conf.d/modsec)

I have googled and searched but don't appear to be able to solve this issue. Can anyone please provide some assistance to explain what might be happening here? The permissions on the folder /var/cpanel/secdatadir/ are set to 777

I removed mod_ruid and installed suPHP and now mod_sec rules are logging and working correctly as expected.... but I have new issues;

1) Server load is much higher - went from averages of around 0.10 to now at around 1.20. I looked at introducing mod_fastcgi to try to bring down averages, but I now see that fastcgi using EA4 is not yet supported. I know this is something common to suPHP but are there any recommended methods to reduce this?

2) In TOP the username is no longer displayed - instead it simply shows as "nobody" - which is not very helpful in terms of trying to view current connections by host.

1) Server load is much higher - went from averages of around 0.10 to now at around 1.20. I looked at introducing mod_fastcgi to try to bring down averages, but I now see that fastcgi using EA4 is not yet supported. I know this is something common to suPHP but are there any recommended methods to reduce this?

Click to expand...

Do you notice any slowness with the websites with the increased load average? In some cases, the increased resource usage with suPHP doesn't necessarily result in any issues with website performance. Note that documentation on ModSecurity rule compatibility with the mod_ruid2 and mod_mpm_itk Apache modules is available at:

One option to consider is to disable the individual rules that are incompatible with Mod_Ruid2 to allow for the use of both modules. You may also find the following feature request informative if you plan to use FPM:

This did not work on my 2.4 Jailed Apache + mod_ruid install. Instead I disabled every rule that relies on DBM. Mainly REQUEST-10-IP-REPUTATION.conf, REQUEST-12-DOS-PROTECTION.conf & bottom of modsecurity_crs_10_setup.conf. That leaves you with most of 19 out of 21 OWASP rules in play depending on what users need. I would rather have some symlink race protection which is not an option with cP suphp and/or BH patch which restricted legit traffic.